workos 7.1.3 → 8.0.0

data/test/workos/test_api_keys.rb

@@ -11,20 +11,6 @@ class ApiKeysTest < Minitest::Test
     @client = WorkOS::Client.new(api_key: "sk_test_123")
   end
 
-  def test_create_validation_returns_expected_result
-    stub_request(:post, %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.api_keys.create_validation(value: "stub")
-    refute_nil result
-  end
-
-  def test_delete_api_key_returns_expected_result
-    stub_request(:delete, %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)})
-      .to_return(body: "{}", status: 200)
-    result = @client.api_keys.delete_api_key(id: "stub")
-    assert_nil result
-  end
-
   def test_list_organization_api_keys_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
@@ -39,12 +25,26 @@ class ApiKeysTest < Minitest::Test
     refute_nil result
   end
 
+  def test_create_validation_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.api_keys.create_validation(value: "stub")
+    refute_nil result
+  end
+
+  def test_delete_api_key_returns_expected_result
+    stub_request(:delete, %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.api_keys.delete_api_key(id: "stub")
+    assert_nil result
+  end
+
   # Parameterized authentication error tests (one per endpoint).
   [
-    {name: :create_validation, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)}, args: {value: "stub"}},
-    {name: :delete_api_key, verb: :delete, url: %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)}, args: {id: "stub"}},
     {name: :list_organization_api_keys, verb: :get, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub"}},
-    {name: :create_organization_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub", name: "stub"}}
+    {name: :create_organization_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub", name: "stub"}},
+    {name: :create_validation, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)}, args: {value: "stub"}},
+    {name: :delete_api_key, verb: :delete, url: %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)}, args: {id: "stub"}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])

data/test/workos/test_authorization.rb

@@ -192,6 +192,13 @@ class AuthorizationTest < Minitest::Test
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
+  def test_list_role_assignments_for_resource_by_external_id_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_role_assignments_for_resource_by_external_id(organization_id: "stub", resource_type_slug: "stub", external_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
   def test_list_resources_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
@@ -259,6 +266,13 @@ class AuthorizationTest < Minitest::Test
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
+  def test_list_role_assignments_for_resource_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources/stub/role_assignments(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_role_assignments_for_resource(resource_id: "stub")
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
   def test_list_environment_roles_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -358,12 +372,14 @@ class AuthorizationTest < Minitest::Test
     {name: :update_resource_by_external_id, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource_by_external_id, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_memberships_for_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/organization_memberships(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", permission_slug: "stub"}},
+    {name: :list_role_assignments_for_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/role_assignments(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_resources, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {parent: WorkOS::Authorization::ParentById.new(parent_resource_id: "stub")}},
     {name: :create_resource, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :get_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
     {name: :update_resource, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
     {name: :list_memberships_for_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub/organization_memberships(\?|\z)}, args: {resource_id: "stub", permission_slug: "stub"}},
+    {name: :list_role_assignments_for_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub/role_assignments(\?|\z)}, args: {resource_id: "stub"}},
     {name: :list_environment_roles, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)}},
     {name: :create_environment_role, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)}, args: {slug: "stub", name: "stub"}},
     {name: :get_environment_role, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub(\?|\z)}, args: {slug: "stub"}},

data/test/workos/test_base_client.rb

@@ -82,36 +82,10 @@ class BaseClientTest < Minitest::Test
     end
   end
 
-  # A pooled connection that either returns a canned response or raises when
-  # driven, so execute_request can be exercised without real TCP+TLS.
-  class StubConnection < FakeConnection
-    attr_accessor :read_timeout, :open_timeout
-
-    def initialize(response: nil, error: nil, **kwargs)
-      super(**kwargs)
-      @response = response
-      @error = error
-    end
-
-    def request(_request)
-      raise @error if @error
-
-      @response
-    end
-  end
-
   def setup
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
 
-  def teardown
-    super
-    # Close any open connections and clear the fiber-local cache to avoid
-    # leaking pooled connections between tests.
-    @client.shutdown
-    Fiber[:workos_connections] = nil
-  end
-
   def test_request_dispatches_known_methods
     client = RecordingClient.new(api_key: "sk_test_123")
 
@@ -196,141 +170,4 @@ class BaseClientTest < Minitest::Test
     assert evict.finished
     refute keep.finished
   end
-
-  # An exception execute_request's rescue clause doesn't list still leaves the
-  # socket mid-stream, so the connection must not survive in the pool for the
-  # next request on this thread to pick up.
-  def test_unlisted_request_error_evicts_the_pooled_connection
-    conn = StubConnection.new(error: Net::HTTPBadResponse.new("wrong version"))
-    cache = @client.send(:thread_connections)
-    cache["https:api.workos.com:443:30"] = conn
-
-    assert_raises(Net::HTTPBadResponse) do
-      @client.execute_request(request: Net::HTTP::Get.new("/things"))
-    end
-
-    refute cache.key?("https:api.workos.com:443:30"),
-      "a connection whose request did not complete must not stay pooled"
-    assert conn.finished
-  end
-
-  def test_completed_request_keeps_the_connection_pooled
-    conn = StubConnection.new(response: Net::HTTPOK.new("1.1", "200", "OK"))
-    cache = @client.send(:thread_connections)
-    cache["https:api.workos.com:443:30"] = conn
-
-    @client.execute_request(request: Net::HTTP::Get.new("/things"))
-
-    assert cache.key?("https:api.workos.com:443:30")
-    refute conn.finished
-  end
-
-  # Raised asynchronously into the worker thread to stand in for a caller-side
-  # abort: Timeout.timeout, Thread#kill, a signal handler unwinding the stack.
-  # It descends from Exception rather than StandardError so that nothing in
-  # execute_request can catch it — the `ensure` is the only cleanup that runs.
-  class AbortSignal < Exception; end # standard:disable Lint/InheritException
-
-  # End-to-end regression test over a real keep-alive socket, for the failure
-  # the eviction actually prevents: request one is abandoned mid-flight, the
-  # server then writes response one onto that socket, and request two on the
-  # same thread reads those stale bytes as if they were its own response.
-  #
-  # Before the fix, request two sees marker "one" (or a mangled response) off
-  # the pooled socket. After it, the abandoned socket is closed and the server
-  # accepts a fresh connection for request two.
-  def test_aborted_request_does_not_leak_its_response_to_the_next_request
-    WebMock.disable!
-    server = TCPServer.new("127.0.0.1", 0)
-    port = server.addr[1]
-    client = WorkOS::BaseClient.new(
-      api_key: "sk_test_123",
-      base_url: "http://127.0.0.1:#{port}",
-      timeout: 5,
-      max_retries: 0
-    )
-
-    request_one_read = Queue.new
-    release_response_one = Queue.new
-    response_one_written = Queue.new
-    aborted = Queue.new
-    connections = Queue.new
-
-    server_thread = Thread.new do
-      # Connection one: read the request, then hold the response back until
-      # the client has been aborted and has unwound.
-      first = server.accept
-      connections << first
-      read_http_request(first)
-      request_one_read << true
-      release_response_one.pop
-      begin
-        write_http_response(first, {marker: "one"})
-      rescue Errno::EPIPE, Errno::ECONNRESET, IOError
-        # Expected once the fix closes the abandoned socket.
-      end
-      response_one_written << true
-
-      # Connection two: a fresh accept, which only completes because the
-      # client did not reuse the socket above.
-      second = server.accept
-      connections << second
-      read_http_request(second)
-      write_http_response(second, {marker: "two"})
-    end
-
-    worker = Thread.new do
-      begin
-        client.execute_request(request: Net::HTTP::Get.new("/one"))
-      rescue AbortSignal
-        # The caller unwinds but the thread survives and goes on to serve more
-        # work, the way a Puma or Solid Queue worker does. execute_request's
-        # `ensure` has already run by the time this body executes.
-        aborted << true
-        response_one_written.pop
-      end
-      response = client.execute_request(request: Net::HTTP::Get.new("/two"))
-      JSON.parse(response.body)["marker"]
-    end
-
-    marker = Timeout.timeout(15) do
-      request_one_read.pop
-      worker.raise(AbortSignal)
-      aborted.pop
-      release_response_one << true
-      worker.value
-    end
-
-    assert_equal "two", marker,
-      "request two read the abandoned socket's response instead of its own"
-  ensure
-    server_thread&.kill
-    worker&.kill
-    until connections.nil? || connections.empty?
-      socket = connections.pop
-      socket.close unless socket.closed?
-    end
-    server&.close
-    WebMock.enable!
-  end
-
-  def read_http_request(socket)
-    socket.gets # request line
-    loop do
-      line = socket.gets
-      break if line.nil? || line == "\r\n"
-    end
-  end
-
-  def write_http_response(socket, body)
-    payload = JSON.generate(body)
-    socket.write(
-      "HTTP/1.1 200 OK\r\n" \
-      "Content-Type: application/json\r\n" \
-      "Content-Length: #{payload.bytesize}\r\n" \
-      "Connection: keep-alive\r\n" \
-      "\r\n#{payload}"
-    )
-    socket.flush
-  end
 end